@workos-inc/node 7.68.0 → 7.69.1

package/lib/sso/interfaces/authorization-url-options.interface.d.ts

@@ -9,6 +9,8 @@ export interface SSOAuthorizationURLOptions {
     domainHint?: string;
     loginHint?: string;
     provider?: string;
+    providerQueryParams?: Record<string, string | boolean | number>;
+    providerScopes?: string[];
     redirectUri: string;
     state?: string;
 }

package/lib/sso/interfaces/profile-and-token.interface.d.ts

@@ -1,10 +1,13 @@
 import { UnknownRecord } from '../../common/interfaces/unknown-record.interface';
+import { OauthTokens, OauthTokensResponse } from '../../user-management/interfaces/oauth-tokens.interface';
 import { Profile, ProfileResponse } from './profile.interface';
 export interface ProfileAndToken<CustomAttributesType extends UnknownRecord> {
     accessToken: string;
     profile: Profile<CustomAttributesType>;
+    oauthTokens?: OauthTokens;
 }
 export interface ProfileAndTokenResponse<CustomAttributesType extends UnknownRecord> {
     access_token: string;
     profile: ProfileResponse<CustomAttributesType>;
+    oauth_tokens?: OauthTokensResponse;
 }

package/lib/sso/serializers/profile-and-token.serializer.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deserializeProfileAndToken = void 0;
+const oauth_tokens_serializer_1 = require("../../user-management/serializers/oauth-tokens.serializer");
 const profile_serializer_1 = require("./profile.serializer");
 const deserializeProfileAndToken = (profileAndToken) => ({
     accessToken: profileAndToken.access_token,
     profile: (0, profile_serializer_1.deserializeProfile)(profileAndToken.profile),
+    oauthTokens: (0, oauth_tokens_serializer_1.deserializeOauthTokens)(profileAndToken.oauth_tokens),
 });
 exports.deserializeProfileAndToken = deserializeProfileAndToken;

package/lib/sso/sso.d.ts

@@ -7,7 +7,7 @@ export declare class SSO {
     constructor(workos: WorkOS);
     listConnections(options?: ListConnectionsOptions): Promise<AutoPaginatable<Connection>>;
     deleteConnection(id: string): Promise<void>;
-    getAuthorizationUrl({ connection, clientId, domain, domainHint, loginHint, organization, provider, redirectUri, state, }: SSOAuthorizationURLOptions): string;
+    getAuthorizationUrl({ connection, clientId, domain, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri, state, }: SSOAuthorizationURLOptions): string;
     getConnection(id: string): Promise<Connection>;
     getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({ code, clientId, }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
     getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({ accessToken, }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;

package/lib/sso/sso.js

@@ -8,21 +8,23 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SSO = void 0;
+const qs_1 = __importDefault(require("qs"));
 const fetch_and_deserialize_1 = require("../common/utils/fetch-and-deserialize");
 const pagination_1 = require("../common/utils/pagination");
 const serializers_1 = require("./serializers");
 const toQueryString = (options) => {
-    const searchParams = new URLSearchParams();
-    const keys = Object.keys(options).sort();
-    for (const key of keys) {
-        const value = options[key];
-        if (value) {
-            searchParams.append(key, value);
-        }
-    }
-    return searchParams.toString();
+    return qs_1.default.stringify(options, {
+        arrayFormat: 'repeat',
+        // sorts the keys alphabetically to maintain backwards compatibility
+        sort: (a, b) => a.localeCompare(b),
+        // encodes space as + instead of %20 to maintain backwards compatibility
+        format: 'RFC1738',
+    });
 };
 class SSO {
     constructor(workos) {
@@ -38,7 +40,7 @@ class SSO {
             yield this.workos.delete(`/connections/${id}`);
         });
     }
-    getAuthorizationUrl({ connection, clientId, domain, domainHint, loginHint, organization, provider, redirectUri, state, }) {
+    getAuthorizationUrl({ connection, clientId, domain, domainHint, loginHint, organization, provider, providerQueryParams, providerScopes, redirectUri, state, }) {
         if (!domain && !provider && !connection && !organization) {
             throw new Error(`Incomplete arguments. Need to specify either a 'connection', 'organization', 'domain', or 'provider'.`);
         }
@@ -52,6 +54,8 @@ class SSO {
             domain_hint: domainHint,
             login_hint: loginHint,
             provider,
+            provider_query_params: providerQueryParams,
+            provider_scopes: providerScopes,
             client_id: clientId,
             redirect_uri: redirectUri,
             response_type: 'code',

package/lib/sso/sso.spec.js

@@ -161,6 +161,54 @@ describe('SSO', () => {
                     expect(url).toMatchInlineSnapshot(`"https://api.workos.com/sso/authorize?client_id=proj_123&connection=connection_123&login_hint=foo%40workos.com&redirect_uri=example.com%2Fsso%2Fworkos%2Fcallback&response_type=code&state=custom+state"`);
                 });
             });
+            describe('with providerScopes', () => {
+                it('generates an authorize url with the provided provider scopes', () => {
+                    const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                    const url = workos.sso.getAuthorizationUrl({
+                        provider: 'Google',
+                        providerScopes: ['profile', 'email', 'calendar'],
+                        clientId: 'proj_123',
+                        redirectUri: 'example.com/sso/workos/callback',
+                    });
+                    expect(url).toMatchSnapshot();
+                });
+                it('handles empty provider scopes array', () => {
+                    const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                    const url = workos.sso.getAuthorizationUrl({
+                        provider: 'Google',
+                        providerScopes: [],
+                        clientId: 'proj_123',
+                        redirectUri: 'example.com/sso/workos/callback',
+                    });
+                    expect(url).toMatchInlineSnapshot(`"https://api.workos.com/sso/authorize?client_id=proj_123&provider=Google&redirect_uri=example.com%2Fsso%2Fworkos%2Fcallback&response_type=code"`);
+                });
+            });
+            describe('with providerQueryParams', () => {
+                it('generates an authorize url with the provided provider query params', () => {
+                    const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                    const url = workos.sso.getAuthorizationUrl({
+                        provider: 'Google',
+                        providerQueryParams: {
+                            custom_param: 'custom_value',
+                            another_param: 123,
+                            bool_param: true,
+                        },
+                        clientId: 'proj_123',
+                        redirectUri: 'example.com/sso/workos/callback',
+                    });
+                    expect(url).toMatchInlineSnapshot(`"https://api.workos.com/sso/authorize?client_id=proj_123&provider=Google&provider_query_params%5Banother_param%5D=123&provider_query_params%5Bbool_param%5D=true&provider_query_params%5Bcustom_param%5D=custom_value&redirect_uri=example.com%2Fsso%2Fworkos%2Fcallback&response_type=code"`);
+                });
+                it('handles empty provider query params', () => {
+                    const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                    const url = workos.sso.getAuthorizationUrl({
+                        provider: 'Google',
+                        providerQueryParams: {},
+                        clientId: 'proj_123',
+                        redirectUri: 'example.com/sso/workos/callback',
+                    });
+                    expect(url).toMatchInlineSnapshot(`"https://api.workos.com/sso/authorize?client_id=proj_123&provider=Google&redirect_uri=example.com%2Fsso%2Fworkos%2Fcallback&response_type=code"`);
+                });
+            });
         });
         describe('getProfileAndToken', () => {
             describe('with all information provided', () => {
@@ -240,6 +288,89 @@ describe('SSO', () => {
                     expect(profile).toMatchSnapshot();
                 }));
             });
+            describe('with oauth tokens in the response', () => {
+                it('returns the oauth tokens from the profile and token response', () => __awaiter(void 0, void 0, void 0, function* () {
+                    (0, test_utils_1.fetchOnce)({
+                        access_token: '01DMEK0J53CVMC32CK5SE0KZ8Q',
+                        profile: {
+                            id: 'prof_123',
+                            idp_id: '123',
+                            organization_id: 'org_123',
+                            connection_id: 'conn_123',
+                            connection_type: 'OktaSAML',
+                            email: 'foo@test.com',
+                            first_name: 'foo',
+                            last_name: 'bar',
+                            role: {
+                                slug: 'admin',
+                            },
+                            groups: ['Admins', 'Developers'],
+                            raw_attributes: {
+                                email: 'foo@test.com',
+                                first_name: 'foo',
+                                last_name: 'bar',
+                                groups: ['Admins', 'Developers'],
+                            },
+                            custom_attributes: {},
+                        },
+                        oauth_tokens: {
+                            access_token: 'oauth_access_token',
+                            refresh_token: 'oauth_refresh_token',
+                            expires_at: 1640995200,
+                            scopes: ['profile', 'email'],
+                        },
+                    });
+                    const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                    const { accessToken, profile, oauthTokens } = yield workos.sso.getProfileAndToken({
+                        code: 'authorization_code',
+                        clientId: 'proj_123',
+                    });
+                    expect(jest_fetch_mock_1.default.mock.calls.length).toEqual(1);
+                    expect(accessToken).toBe('01DMEK0J53CVMC32CK5SE0KZ8Q');
+                    expect(profile).toBeDefined();
+                    expect(oauthTokens).toEqual({
+                        accessToken: 'oauth_access_token',
+                        refreshToken: 'oauth_refresh_token',
+                        expiresAt: 1640995200,
+                        scopes: ['profile', 'email'],
+                    });
+                }));
+            });
+            describe('without oauth tokens in the response', () => {
+                it('returns undefined for oauth tokens when not present in response', () => __awaiter(void 0, void 0, void 0, function* () {
+                    (0, test_utils_1.fetchOnce)({
+                        access_token: '01DMEK0J53CVMC32CK5SE0KZ8Q',
+                        profile: {
+                            id: 'prof_123',
+                            idp_id: '123',
+                            organization_id: 'org_123',
+                            connection_id: 'conn_123',
+                            connection_type: 'OktaSAML',
+                            email: 'foo@test.com',
+                            first_name: 'foo',
+                            last_name: 'bar',
+                            role: {
+                                slug: 'admin',
+                            },
+                            raw_attributes: {
+                                email: 'foo@test.com',
+                                first_name: 'foo',
+                                last_name: 'bar',
+                            },
+                            custom_attributes: {},
+                        },
+                    });
+                    const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                    const { accessToken, profile, oauthTokens } = yield workos.sso.getProfileAndToken({
+                        code: 'authorization_code',
+                        clientId: 'proj_123',
+                    });
+                    expect(jest_fetch_mock_1.default.mock.calls.length).toEqual(1);
+                    expect(accessToken).toBe('01DMEK0J53CVMC32CK5SE0KZ8Q');
+                    expect(profile).toBeDefined();
+                    expect(oauthTokens).toBeUndefined();
+                }));
+            });
         });
         describe('getProfile', () => {
             it('calls the `/sso/profile` endpoint with the provided access token', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/workos.js

@@ -32,7 +32,7 @@ const actions_1 = require("./actions/actions");
 const vault_1 = require("./vault/vault");
 const conflict_exception_1 = require("./common/exceptions/conflict.exception");
 const parse_error_1 = require("./common/exceptions/parse-error");
-const VERSION = '7.68.0';
+const VERSION = '7.69.1';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 const HEADER_AUTHORIZATION = 'Authorization';
 const HEADER_IDEMPOTENCY_KEY = 'Idempotency-Key';

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.68.0",
+  "version": "7.69.1",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",